Multi-system single sign-on security management method and system, storage medium and equipment

Abstract

The invention relates to the technical field of information security, and discloses a multi-system single sign-on security management method and system, a storage medium and equipment, and the method comprises the steps: building a deep integration architecture between a directory service and an identity management server, and achieving the bidirectional synchronization of user attributes and security policies; a unified multi-factor authentication process and a security defense strategy are configured in the identity management server; by implementing password expiration risk assessment, multi-channel reminding and password self-service modification service, intelligent password life cycle active management is realized; intelligent account locking and self-adaptive unlocking based on multiple factors are implemented, and differentiated locking duration is dynamically calculated and executed; a cross-system unified session management and cooperative control mechanism is established, session anomaly real-time detection and scoring are performed through multi-dimensional feature fusion, one-point logout of global failure is realized, cross-system unified authentication, active security protection and cooperative management and control are realized, and the security and operation and maintenance efficiency of enterprise identity management are remarkably improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and particularly relates to a multi-system single sign-on security management method and system, a storage medium and equipment. BACKGROUND

[0002] In the modern enterprise informatization construction, in order to support different business functions, multiple independent business systems such as office automation systems, customer relationship management systems, enterprise resource planning systems, etc. are usually deployed. In the traditional mode, each business system maintains an independent user authentication system, which leads to the need for employees to remember multiple sets of credentials, which not only seriously affects work efficiency and user experience, but also brings significant security risks due to password reuse, simple password proliferation, etc. To solve this problem, single sign-on technology has emerged, which allows users to access all mutually trusted application systems through a single identity authentication. At present, the industry generally adopts a scheme combining the Lightweight Directory Access Protocol and a professional identity management server to realize enterprise-level single sign-on. Among them, LDAP (Lightweight Directory Access Protocol) is a mature directory service protocol used to build a unified user directory to centrally store user account and organizational structure information; and open source identity management solutions such as Keycloak provide powerful single sign-on capabilities based on standard protocols such as OAuth 2.0, OpenID Connect, etc., which can serve as a unified authentication portal.

[0003] However, the prior art still has obvious deficiencies in practical application, and cannot systematically solve the deep security management problem in the enterprise environment. First, the integration of Lightweight Directory Access Protocol and single sign-on system often stays at the basic user authentication level, lacks a deep two-way data synchronization mechanism and unified security policy management capability, leading to possible inconsistency of user identity information and security state between the two systems, forming a management split. Second, in terms of password management, the existing scheme generally adopts a passive response mode, only verifying the password validity when the user logs in, and forcing modification after the password expires. This way lacks active monitoring and early warning of the password life cycle, and users are often interrupted in business operations due to the sudden expiration of the password without warning, seriously affecting work continuity and increasing technical support pressure. Third, in terms of account security protection, the traditional account locking mechanism usually uses a fixed failure number threshold and locking duration, which cannot distinguish between ordinary employee's misoperation and malicious brute force attack on high-privilege accounts, and lacks intelligence for dynamic adjustment according to security level and attack characteristics. Fourth, in terms of session management, the login state of users in different business systems is independent of each other, lacking a unified view and cooperative control mechanism across systems. This not only makes it difficult to achieve "one point logout, global failure", but also makes it difficult to detect and respond to abnormal sessions in real time, posing security risks such as session hijacking. Finally, security-related audit logs are scattered in various application systems and identity management servers, forming information silos, making it difficult to conduct correlation analysis and unified traceability, and not conducive to the enterprise's overall security situation awareness and subsequent security incident investigation and compliance audit.

[0004] Therefore, there is an urgent need in the art for a multi-system single sign-on security management method that can achieve deep unified management, active defense capability and intelligent cooperative control characteristics on the basis of existing technology, to systematically solve the above problems. SUMMARY

[0005] The purpose of the present application is to solve the above-mentioned shortcomings in the prior art, and to provide a single sign-on security management method based on directory service and identity management server, by building two-way synchronization, intelligent password management, dynamic account locking and unified session control modules, to achieve cross-system unified authentication, active security protection and cooperative control, significantly improving the security and operation efficiency of enterprise identity management.

[0006] On the one hand, a multi-system single sign-on security management method is provided, comprising the following steps: S1: Establishing a deep integration architecture between the directory service and the identity management server, realizing two-way synchronization of user attributes and security policies by configuring user federation and attribute mapping relationship; S2: Configuring a unified multi-factor authentication process and security defense strategy in the identity management server; S3: Realize intelligent password life cycle active management by implementing risk score based password expiration assessment and multi-channel reminders, and password self-service modification service; S4: Implement multi-factor based intelligent account locking and adaptive unlocking, dynamically calculate and execute differentiated lock duration through progressive locking algorithm; S5: Establish unified session management and collaborative control mechanism across systems, conduct real-time session anomaly detection and scoring through multi-dimensional feature fusion, and realize one-point logout global invalidation based on post-channel logout mechanism.

[0007] Further, in step S1, the deep integration architecture between the directory service and the identity management server specifically includes: Design a standardized user entry structure in the directory service, which includes basic attributes, authentication attributes, security attributes, and extended attributes; Configure user federation in the identity management server, set connection parameters, user search reference location, and user identification mapping rules with the directory service; Establish a bidirectional mapping relationship between the directory service attributes and the identity management server user attributes; Enable periodic full synchronization and periodic incremental synchronization mode to realize bidirectional synchronization and change write-back of user data.

[0008] Further, in step S2, configuring a unified multi-factor authentication process and security defense strategy specifically includes: Customize the authentication process, add multiple authentication execution steps in order, including session existence check, user account state pre-check, username and password form authentication, password expiration check, and conditional two-factor authentication; Configure brute force cracking protection strategy, set maximum login failure number, failure attempt statistical time window, failure waiting time, and failure counter reset time; Configure token strategy, set access token life cycle, client login timeout time, and overall login flow timeout time; Configure global password policy, set password complexity requirements, including minimum length, character type combination, historical password repetition limit, and weak password pattern detection rules based on regular expressions.

[0009] Further, in step S3, the risk score based password expiration assessment includes: Scan active users in the directory service through a monitoring mechanism at regular intervals, obtain the last password modification time of each user and the user security level; Based on the number of remaining valid days of the password, the user security level, the user historical password modification compliance rate, and the number of recent login failures, the password expiration risk score is calculated through weighted calculation; The alert strategy is dynamically determined based on the risk score, and the alert strategy is a combination of alert frequency and alert channel, which includes one or more of email, SMS and system messages.

[0010] Preferably, in step S3, the password self-service modification service: Provides a password modification interface that integrates a real-time password strength detection function to dynamically evaluate whether the password meets the preset complexity requirements; The system verifies the correctness of the current password, whether the new password meets the policy requirements, and whether the new password is a duplicate of a previous password in the background. Once verification is successful, the user's password credentials in the identity management server and directory service are updated synchronously, and all existing sessions of the user are invalidated.

[0011] Furthermore, in step S4, the multi-factor-based smart account lockout specifically includes: Configure differentiated account lockout policies for users with different security levels, including the maximum number of allowed failures, the time window for counting failures, the basic lockout duration, and whether to enable progressive lockout; When the number of failed login attempts by a user reaches a set threshold, the actual lock duration is dynamically calculated based on the user's security level, the number of historical lock attempts within a specific time window, and the attack pattern characteristics presented by this failed attempt. The lock duration increases exponentially based on the number of historical locks and is adjusted according to attack pattern characteristics and security level, while also setting an upper limit for the lock duration.

[0012] Preferably, the determination of the attack mode characteristics includes: Analyze whether failed attempts originated from multiple different network addresses; if so, it indicates the presence of a distributed attack. Analyze whether the time interval between failed attempts is less than a specific threshold; if so, determine that there are characteristics of an automated attack. Based on the judgment results of distributed attacks and automated characteristics, the attack mode coefficient is comprehensively determined and used to adjust the lockout duration.

[0013] More preferably, the adaptive unlocking includes: The system scans locked accounts via a scheduled task. When the system time exceeds the lock duration, it automatically performs the unlocking operation, restores the account status, and clears related failure records. Administrators can manually unlock accounts through the management interface. When manually unlocking, the administrator's identity and the reason for unlocking must be recorded, and the audit log must be updated.

[0014] Furthermore, in step S5, the real-time detection of session anomalies specifically includes: Real-time monitoring of user sessions, collecting multi-dimensional features including login geographic location, device fingerprint information, user operation behavior characteristics, and login time sequence; Based on the multi-dimensional features, respectively calculate the geographic location abnormality, device abnormality, behavior abnormality and speed abnormality, and weight and fuse each abnormality to obtain a comprehensive session abnormality score; According to the different intervals of the session abnormality score, trigger the corresponding processing strategy, including recording log, sending security warning to the user and requiring secondary verification, or immediately terminating the session and notifying the administrator.

[0015] Preferably, the calculation of the speed abnormality involves impossible travel detection: Obtain the geographic location and corresponding time interval of the user's previous and subsequent logins; Calculate the physical distance between the two points based on the geographic location, and calculate the required minimum theoretical time based on the preset travel speed; Compare the actual time interval with the theoretical time. If the actual time interval is less than the minimum theoretical time, it is determined that there is an impossible travel situation, and the speed abnormality is calculated accordingly.

[0016] Further, in step S5, the one-point logout global failure is achieved by the following way: Configure a back channel logout address for each integrated client system in the identity management server; When the user initiates a logout request in any system, the identity management server destroys the central session and sends a logout notification to the back channel logout addresses of all client systems that the user has logged in; After receiving the logout notification, each client system verifies the message validity and then destroys its local session.

[0017] Preferably, the method further comprises providing an administrator with a unified session management interface, which: Obtains and displays a list of all active sessions by calling the management interface, and the list information includes user identification, client network address, session duration, associated client system and session state; Provides filtering and searching functions by user identification, client system or session state, and supports automatic periodic refreshing of list data; Provides session profile viewing function for displaying user's detailed information, session's detailed device fingerprint information and parsed geographic location information, session's abnormality detection detailed results, and session's associated authentication event timeline; Supports manual selection of one or more sessions by the administrator and forced termination, and the termination operation triggers the identity management server to send a logout notification to the related client systems.

[0018] In another aspect, a multi-system single sign-on security management system is also provided, comprising: a deep integration and bidirectional synchronization module, configured to establish a deep integration architecture between a directory service and an identity management server, and realize bidirectional synchronization of user attributes and security policies by configuring user federation and attribute mapping relationships; a unified authentication and security defense module, configured to configure a unified multi-factor authentication process and security defense policy in the identity management server; an intelligent password life cycle management module, configured to realize intelligent password life cycle active management by implementing risk score-based password expiration evaluation and multi-channel reminders, and password self-service modification services; an intelligent account locking and unlocking module, configured to implement multi-factor-based intelligent account locking and adaptive unlocking, and dynamically calculate and execute differentiated locking durations through a progressive locking algorithm; a unified session management and cooperative control module, configured to establish a unified session management and cooperative control mechanism across systems, detect and score session abnormalities in real time through multi-dimensional feature fusion, and realize one-point logout global invalidation based on a post-channel logout mechanism.

[0019] In addition, a computer-readable storage medium is provided, which stores a computer program, and the program is executed by a processor to implement the multi-system single sign-on security management method of any one of the above aspects.

[0020] Meanwhile, an electronic device is provided, comprising: one or more processors; a storage device configured to store one or more programs, which, when executed by the one or more processors, cause the one or more processors to implement the multi-system single sign-on security management method of any one of the above aspects.

[0021] Compared with the prior art, the present application has the following advantages: By constructing a deep integration architecture and a bidirectional synchronization mechanism between a directory service and an identity management server, the present application realizes centralized management and real-time synchronization of user data and security policies, solves the problem of fragmented and inconsistent identity information in traditional solutions, and significantly improves the efficiency and accuracy of enterprise identity management; The present application realizes precise evaluation based on multi-dimensional risks and proactive notification in advance by means of intelligent password life cycle active management, effectively avoids business interruption caused by sudden password expiration, and at the same time, integrates self-service modification functions to simplify user operations while ensuring security, thereby improving the convenience of use; The application changes the extensive mode of traditional fixed threshold locking by introducing a multi-factor based intelligent account locking and adaptive unlocking module, can dynamically apply differentiated locking duration according to the security level and attack posture, effectively curb attacks such as brute force cracking, especially the key protection of high-value accounts, and thus builds a more intelligent, adaptive active security line; The application realizes centralized monitoring and real-time detection of abnormal states of cross-system sessions by establishing a unified session management and collaborative control mechanism, and the one-point logout global failure function completely eliminates the risk of session residue, effectively prevents session hijacking, and strengthens the global control ability of user login state. BRIEF DESCRIPTION OF DRAWINGS

[0022] The accompanying drawings are included to provide a further understanding of the application, and constitute a part of the specification, together with the embodiments of the application, to explain the application, and do not constitute a limitation on the application. In the drawings: Figure 1 A flow chart of a multi-system single sign-on security management method of the application; Figure 2 A block diagram of a multi-system single sign-on security management system structure of the application; Figure 3 An embodiment schematic diagram of an electronic device of the application. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be described clearly and completely below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0024] The specific implementation of the application will be described below in combination with the drawings and embodiments.

[0025] Embodiment 1 Please refer to Figure 1 A technical scheme of a multi-system single sign-on security management method provided by the embodiment includes the following steps: S1: Establish a deep integration architecture between the directory service and the identity management server, realize the bidirectional synchronization of user attributes and security policies by configuring user federation and attribute mapping relationship; S2: Configure a unified multi-factor authentication process and security defense strategy in the identity management server; S3: Through risk score-based password expiration assessment and multi-channel reminders, as well as password self-service modification services, intelligent password life cycle proactive management is realized; S4: Implement multi-factor-based intelligent account locking and adaptive unlocking, dynamically calculate and execute differentiated lock duration through progressive locking algorithms; S5: Establish a unified session management and collaborative control mechanism across systems, conduct real-time session anomaly detection and scoring through multi-dimensional feature fusion, and realize one-point logout global invalidation based on the post-channel logout mechanism.

[0026] Firstly, the directory service in step S1 is an LDAP (Lightweight Directory Access Protocol, same below) service, and a standardized organizational structure and user attribute model are established in the LDAP server. The user entry structure is designed to include basic attributes, authentication attributes, security attributes, and extended attributes. Specifically, the basic attributes include user unique identifier uid, common name cn, surname sn, email mail, mobile phone number mobile, and other basic information fields. The authentication attributes include password hash userPassword, password last modification time pwdChangedTime, password policy reference pwdPolicySubentry, and other fields related to authentication. The security attributes cover failed login timestamp pwdFailureTime (multi-value attribute, recording multiple failed attempts), account lock time pwdAccountLockedTime, and account status accountStatus (optional values: active, locked, expired). The extended attributes include employee type employeeType, department department, and security level securityLevel (1-5 levels, the higher the level, the stricter the security requirements).

[0027] Next, the deep integration architecture between the directory service of step S1 and the identity management server includes: Configure user federation in the identity management server, set connection parameters, user search reference location, and user identification mapping rules with the directory service, and establish a bidirectional mapping relationship between the directory service attributes and the identity management server user attributes; Enable periodic full synchronization and periodic incremental synchronization mode in the identity management server to periodically synchronize user data from the directory service to the identity management server, and support writing back user changes from the identity management server to the directory service.

[0028] Specifically, we log in to the Keycloak (Identity Authentication and Access Management Tool, hereinafter the same) management console. Create a dedicated Realm named enterprise-realm for enterprise application integration. Select the UserFederation menu in the left navigation bar, and click Add provider to add an LDAP provider. Configure the LDAP connection parameters, pointing to the enterprise LDAP server address and port. Bind Type selects simple simple binding mode. Bind DN fills in cn=admin,dc=company,dc=com, which is an LDAP management account with read and write permissions. Bind Credential fills in the administrator password, which is used for Keycloak to connect to LDAP for operation.

[0029] First, configure the user search parameters. Users DN is set to ou=users,dc=company,dc=com, which specifies the search reference location of the user item. Username LDAP attribute is set to uid, indicating that the uid attribute is used as the username. RDN LDAP attribute is set to uid, indicating that the relative distinguished name also uses uid. UUID LDAP attribute is set to entryUUID, which is used to uniquely identify users. User Object Classes are set to inetOrgPerson,pwdPolicy, which specifies the user object class.

[0030] Then configure the synchronization mode parameters. Edit Mode selects WRITABLE writable mode, allowing Keycloak to write changes back to LDAP. Sync Registrations is on, indicating that new users registered in Keycloak will be synchronized to create to LDAP. Import Users is on, importing existing users in LDAP to Keycloak. Vendor selects Other (or according to the actual LDAP server, select Active Directory, Red Hat Directory Server, etc.). Batch Size is set to 1000, indicating that 1000 users are synchronized in each batch.

[0031] Finally, configure the attribute mappers Mappers to establish a bidirectional mapping between LDAP attributes and Keycloak user attributes. Create a username mapper with LDAP Attribute set to uid, User Model Attribute set to username, and Read Only turned off to allow bidirectional synchronization. Create an email mapper with LDAP Attribute set to mail, User Model Attribute set to email. Create a firstName mapper with LDAP Attribute set to cn, User Model Attribute set to firstName. Create a lastName mapper with LDAP Attribute set to sn, User Model Attribute set to lastName. Create a custom attribute mapper mobile with LDAP Attribute set to mobile, User Model Attribute set to mobile, and Always Read Value From LDAP turned on. Create a securityLevel mapper with LDAP Attribute set to securityLevel, User Model Attribute set to securityLevel. Create a department mapper with LDAP Attribute set to department, User Model Attribute set to department.

[0032] In this example, a bidirectional synchronization strategy is configured and a first full synchronization is performed. On the LDAP provider configuration page of User Federation, find the Sync Settings area. Set Periodic Full Sync to Enabled, Full Sync Period to 3600 seconds, which means a full synchronization is performed every hour to update all users in LDAP to Keycloak. Set Periodic Changed Users Sync to Enabled, Changed Users Sync Period to 300 seconds, which means an incremental synchronization is performed every 5 minutes to synchronize only the changed user information. Click the Synchronize all users button to perform the first full synchronization, and the system starts importing users from LDAP. Assuming there are 5000 employee accounts in the enterprise LDAP, the synchronization process takes about 5-10 minutes to complete. After synchronization is complete, you can see the list of all imported users in the Users menu of Keycloak. Randomly check several users to verify that the standard attributes such as username, email, firstName, lastName, etc. are correct, and especially check whether the custom attributes securityLevel, department, mobile are successfully mapped. For example, view the user zhangsan and confirm that the securityLevel is displayed as 3, the department is displayed as IT, and the mobile is displayed as 13800138000.

[0033] After that, step S2 of configuring a unified multi-factor authentication process and security defense strategy in the identity management server is performed, which specifically includes: Customize the authentication process, in which multiple authentication execution steps are added in sequence, including session existence check, user account state pre-check, username and password form authentication, password expiration check, and conditional two-factor authentication; Configure a brute force protection strategy, set the maximum number of login failures, failure attempt time window, waiting time after failure, and failure counter reset time; Configure a token strategy, set the access token lifetime, client login timeout time, and overall login process timeout time; Configure a global password policy, set password complexity requirements, including minimum length, character type combination, historical password repetition limit, and weak password pattern detection based on regular expressions.

[0034] Specifically, in the present embodiment, the Browser Flow browser authentication process is customized in the Authentication menu of Keycloak to enhance security control. The default browser flow is copied to create a new flow, custom-browser-flow. Multiple execution steps are added in the flow: the first step is Cookie authentication check, which directly passes if the user's browser has a valid SSO Cookie; the second step is account status pre-check, which creates a custom Authenticator executor to read the accountStatus attribute of the user from LDAP, and if the status is locked, the login is rejected and the user is prompted that the account is locked, and if the status is expired, the user is guided to reset the password; the third step is the username / password form authentication, which displays a standard login form for the user to input credentials; the fourth step is the password expiration check, which calculates the difference between the user's pwdChangedTime and the current time, obtains the corresponding password maximum validity period according to the user's securityLevel, and judges whether the password is about to expire or has expired, and if it is about to expire (within 7 days of expiration), a warning flag is set in the authentication session, and if it has expired, the user is forced to jump to the password modification page; the fifth step is the two-factor authentication OTP, which is set as Conditional conditional execution, and only when the user's securityLevel is greater than or equal to 4 is the one-time password required for secondary verification.

[0035] The brute force protection is configured in the Security Defenses tab page of Realm Settings. The Brute Force Detection function is enabled. The Max Login Failures is set to 5 times. The Quick Login Check Milli Seconds is set to 1000 milliseconds to prevent rapid attempts within a short period of time. The Minimum Quick Login Wait is set to 60 seconds. The WaitIncrement Seconds is set to 60 seconds, which increases the waiting time after each failure. The Max Wait is set to 900 seconds (15 minutes). The Failure Reset Time is set to 43200 seconds (12 hours), i.e., the failure count is reset after 12 hours.

[0036] Configure the token policy in the Tokens tab of the Realm Settings. Set the Access Token Lifespan to 5 minutes (300 seconds) to ensure that even if a token is compromised, it will only be valid for a short period of time. Set the Access Token Lifespan For Implicit Flow to 15 minutes. Set the Client login timeout to 5 minutes. Set the Login timeout to 30 minutes. Set the Login action timeout to 5 minutes, which means the user must complete the login flow within 5 minutes.

[0037] Configure the global password complexity requirements in the Password Policy tab of the Realm Settings. Add the policy item Minimum Length with a value of 12. Add the Special Characters policy with a value of 2 to require at least 2 special characters. Add the Uppercase Characters policy with a value of 2. Add the Lowercase Characters policy with a value of 2. Add the Digits policy with a value of 2. Add the Not Username policy to ensure the password cannot contain the username. Add the Password History policy with a value of 5 to prevent the use of the last 5 passwords. Add the Regular Expression policy to prevent the use of common weak password patterns.

[0038] Next, perform the password expiration risk assessment and multi-channel reminders in step S3, including: Scan the active users in the directory service at regular intervals through an independent monitoring mechanism to obtain the last modification time of the password of each user and the security level of the user; Based on the remaining valid days of the password, the security level of the user, the historical password modification compliance rate of the user, and the number of recent login failures, a weighted calculation is performed to obtain a password expiration risk score; According to the risk score, dynamically determine the reminder policy of different urgency levels, the reminder policy being a combination of reminder frequency and reminder channel, and the reminder channel including one or more of email, SMS, and system message.

[0039] Specifically, a separate password monitoring service is developed and deployed on an enterprise internal server, which scans the LDAP directory through a scheduled task to identify users whose passwords are about to expire and execute the above risk assessment algorithm. The monitoring service adopts a distributed task scheduling architecture and supports horizontal expansion. The core scheduled task is designed to perform a full scan at 2 a.m. every day. The scan strategy is divided into two stages: the first stage is a fast scan that only reads the user's uid, pwdChangedTime, securityLevel and other key attributes, and preliminarily filters out users whose password remaining validity period is less than 30 days; the second stage is a deep analysis that executes the risk assessment algorithm on the filtered users, calculates the risk score R, and determines the reminder strategy according to the score.

[0040] The monitoring service connects to the LDAP server and uses the administrator account to perform LDAP search operations. The search filter is set to ( (& (objectClass=inetOrgPerson) (accountStatus=active) ), which only scans active users and excludes locked or disabled accounts. The search scope is set to ou=users, dc=company, dc=com and all its sub-entries. For each user entry returned, the pwdChangedTime attribute value is extracted, which is in LDAP timestamp format (e.g. 20250101080000Z). The timestamp is converted to standard date format, and the difference between the current date and the password modification date is calculated to obtain the number of days the password has been used. According to the user's securityLevel attribute value, the corresponding password policy object is queried to obtain the pwdMaxAge maximum validity period value. The remaining validity period of the password D = M - (current date - password modification date) is calculated.

[0041] If D is less than 30 days, the user is added to the evaluation queue. For users in the queue, the past 12 months of password modification records are queried from the historical database to count the number of password expiration times and active modification times, and the historical compliance rate H is calculated. The login log of the recent 7 days is queried to count the number of login failures, and the failure factor F is calculated. The user's security level S is extracted. All parameters are substituted into the risk assessment algorithm formula to calculate the risk score R. According to the R value, the reminder level (urgent / high frequency / regular / low frequency / no need to remind) is determined.

[0042] On this basis, the present application introduces a password expiration risk assessment algorithm, which comprehensively considers multiple factors such as the remaining validity period of the password, the security level of the user, and the historical expiration handling behavior, and quantitatively evaluates the risk degree of the password expiration to determine the urgency and frequency of the reminder. The password expiration risk value calculation formula is as follows: Wherein, represents the password expiration risk score, with a value range of [0, 1], the larger the value, the higher the risk, represents the number of remaining valid days for the password, represents the maximum valid period of the password determined according to the user security level, represents the user security level, with a value range of [1, 5], represents the user historical password expiration processing compliance rate, with a value range of [0, 1], indicating the proportion of past timely password modification by the user, represents the recent login failure number factor, with a value range of [0, 1], calculated by normalizing the number of failures; 、 、 and are the weight coefficients of the above four indicators, respectively, satisfying In this embodiment, they are 0.4, 0.3, 0.2, and 0.1, respectively.

[0043] Then the reminder strategy determines according to the risk score R: When R ≥ 0.8, trigger an emergency reminder: triple notification through email + SMS + system message every day; When 0.6 ≤ R < 0.8, trigger a high-frequency reminder: notification through email + system message every 2 days; When 0.4 ≤ R < 0.6, trigger a regular reminder: notification through email every 5 days; When 0.2 ≤ R < 0.4, trigger a low-frequency reminder: notification through email every 10 days; When R < 0.2, no active reminder is needed.

[0044] In this embodiment, we calculate the password expiration risk score of user Li Si. Li Si's basic information is as follows: security level S = 4 (high security level user), according to the security level, the maximum validity period of the password M = 30 days. The current distance to the password expiration is D = 5 days. Query the historical record, Li Si experienced 4 password expiration periods in the past 12 months, 3 of which were actively modified before expiration, and 1 was forced to modify after expiration, so the historical compliance rate H = 3 / 4 = 0.75. Query the recent login log, Li Si has 2 login failure records in the past 7 days, the failure factor is calculated according to the formula F = min(failure_count / 10, 1) F = 2 / 10 = 0.2. Substitute the numerical value into the formula to calculate: R = 0.4 × (1 - 5 / 30) + 0.3 × (4 / 5) + 0.2 × (1 - 0.75) + 0.1 × 0.2 R = 0.4 × 0.833 + 0.3 ×0.8 + 0.2 × 0.25 + 0.1 × 0.2 R = 0.333 + 0.24 + 0.05 + 0.02 R = 0.643. The risk score R = 0.643 is in the interval [0.6, 0.8), the system determines the high frequency reminder level. Therefore, the system formulates the reminder strategy for Li Si: remind him to modify the password in time through email and system message every 2 days. If Li Si continues to not modify the password, when the remaining days D drops to 3 days, the risk score R = (0.4 × 0.9 + 0.3 × 0.8 + 0.2 × 0.25 + 0.1 × 0.2) = 0.72, still in the high frequency reminder interval. When the remaining days D drops to 1 day, R = (0.4 × 0.967 + 0.3 × 0.8 + 0.24 × 0.25 + 0.1 × 0.2) = 0.857, which exceeds the threshold of 0.8, and the reminder strategy is automatically upgraded to urgent reminder, which is notified through email, SMS and system message every day.

[0045] Compared with the traditional fixed time point reminder (such as 7 days, 3 days, 1 day before expiration), the algorithm can dynamically adjust the reminder frequency and channel according to the actual risk of the user, and the high-risk user obtains more intensive reminders to avoid business interruption caused by accidental password expiration. The algorithm considers the user's historical behavior pattern, reduces the disturbance for compliant users who frequently modify their passwords, and enhances the reminder intensity for users who frequently delay, achieving personalized reminder strategies. Thirdly, by quantifying the risk score, the system can generate a password management risk report to help administrators identify high-risk user groups and conduct targeted security training and management. After actual deployment, data shows that technical support tickets caused by accidental password expiration have decreased by 67%, and user satisfaction has increased by 35%.

[0046] In step S3, the password self-service modification service: It provides a user-friendly password modification interface, which integrates a real-time password strength detection function to dynamically evaluate whether the password meets the preset complexity requirements; The system verifies the correctness of the current password, whether the new password meets the policy requirements, and whether the new password is a duplicate of a previous password in the background. After successful verification, update the user's password credentials in the identity management server and directory service, and execute an operation to invalidate all existing sessions of that user.

[0047] Specifically, in this embodiment, a customized password change interface is provided based on the Keycloak Account Console (the interface on Keycloak used to manage user accounts, passwords, multi-factor authentication, and session history), offering a user-friendly self-service password change process. Users access the account management page through the SSO portal. After clicking the "Change Password" link, the system first verifies the validity of the user's current session. If the session has timed out, the user is required to log in again. Upon successful verification, a password change form is displayed, containing three input fields: Current Password, New Password, and Confirm New Password.

[0048] The new password input field integrates real-time password strength detection. As the user enters characters, the front-end JavaScript script analyzes the password composition in real time. The detection logic includes: length check (at least 12 characters), uppercase letter check (at least 2), lowercase letter check (at least 2), number check (at least 2), special character check (at least 2), username inclusion check (cannot contain), and common weak password checks (such as 12345678, password, etc.). Each check corresponds to a visual indicator; a green checkmark is displayed when the requirement is met, and a red cross is displayed when the requirement is not met. Password strength is dynamically displayed via a progress bar, divided into three levels: weak (red), medium (yellow), and strong (green).

[0049] After a user submits a password change request, the backend executes a series of verification steps. The first step verifies the correctness of the current password using Keycloak's password verification API. If the current password is incorrect, the change is rejected and the error message "Incorrect password" is returned. The second step checks if the new password conforms to the password policy, including requirements for length, complexity, and character composition. If it does not conform, the specific non-compliance is returned. The third step queries the password history table, which stores the hash values ​​of the user's last 5 passwords (configured according to the password policy). The new password is compared with the historical passwords using the bcrypt algorithm. If they are duplicated, the change is rejected and the message "The new password cannot be the same as the password used in the last 5 times" is displayed. The fourth step verifies whether the new password matches the confirmation password.

[0050] After all verifications pass, the password update operation is executed. The user credential table is updated in the Keycloak database, and the new password is stored after being hashed using the bcrypt algorithm (with a work factor of 12). The password change is synchronized to the LDAP through the User Federation mechanism, updating the userPassword attribute to the SSHA-encrypted password hash and the pwdChangedTime attribute to the current timestamp in the LDAP-standard Generalized Time format (e.g., 20250118120000Z).

[0051] After the password modification is successful, the system performs subsequent operations. First, the hash value of this password is appended to the password history record table, and if the number of history records exceeds the policy limit (e.g., 5), the earliest record is deleted to keep the number of records within the limit. Second, all sessions of the user on all devices are forcibly invalidated, which is achieved through the session management API of Keycloak, iterating through all UserSession objects of the user and calling the removeUserSession method one by one, ensuring that the user needs to log in again on all devices to continue using the system, preventing sessions that have been compromised before the password modification from being exploited. Third, a password modification success notification email is sent to the user's mailbox, including the modification time, operation IP address, device information, etc., and if the user himself did not perform this operation, he can immediately contact the administrator. Fourth, detailed audit logs are recorded, including user ID, username, operation time, operation type (PASSWORD_CHANGE), client IP address, User Agent, operation result (SUCCESS), etc., and the audit logs are written to a separate audit database for security analysis and compliance review.

[0052] Next, the intelligent account locking and adaptive unlocking of step S4 are performed, wherein the multi-factor-based intelligent account locking specifically includes: Different account locking policies are configured for users of different security levels, including the maximum number of allowed failures, the time window for counting failures, the basic lock duration, and whether to enable gradual locking; When the number of user login failures reaches the set threshold, the actual lock duration for this time is dynamically calculated based on the user's security level, the number of historical lockings within a certain time window, and the attack pattern characteristics presented by this failure attempt; The lock duration is determined based on the number of historical lockings in an exponential relationship, and is adjusted according to the attack pattern characteristics and security level, with an upper limit set for the lock duration.

[0053] The determination of the attack pattern characteristics includes: analyzing whether the failed attempts originate from multiple different network addresses to determine whether it is a distributed attack; analyzing whether the time interval between the failed attempts is less than a certain threshold to determine whether it is an automated attack; based on the determination results of the distributed attack and the automated attack, a mode of attack coefficient is comprehensively determined to adjust the lock duration.

[0054] wherein the lock duration calculation formula is as follows: wherein, is the current lock duration, is the basic lock duration, which is determined according to the user security level, is the cumulative number of lock times of the user within a time window W (including the current one), is the user security level, the value range is [1, 5], is the security level amplification coefficient, the value is 0.2, is the mode of attack coefficient, the value range is [1, 2]. The basic lock duration of the embodiment The corresponding relationship between the security level and the basic lock duration is as follows: Security level 1: minutes; security level 2: minutes; security level 3: minutes; security level 4: minutes; security level 5: minutes.

[0055] The determination rule of the mode of attack coefficient μ is as follows: If the failed attempts come from multiple different IP addresses, it is determined to be a distributed attack, μ = 1.5 If the failed attempts occur at a high frequency in a very short time (time interval < 1 second), it is determined to be an automated attack, ; if both the distributed and high-frequency features are met, it is determined to be an advanced persistent attack, ; in normal circumstances, .

[0056] The upper limit of the lock duration is set to 24 hours (1440 minutes), that is, T_max = 1440, and the actual lock duration T_actual = min(T, T_max).

[0057] The algorithm formula effectively curbs brute force attacks through a progressive exponential growth penalty mechanism. Each time the attacker fails, the lockout time increases exponentially, significantly increasing the attack cost. Real-world data shows that after adopting this algorithm, the success rate of brute force attacks against high-security level accounts decreased by 92%. The algorithm takes into account attack pattern characteristics, imposing an additional penalty coefficient on distributed attacks and automated attacks, making advanced attack methods face longer lockout times, while ordinary users who occasionally mistype their passwords are not excessively penalized. Third, the differentiated base lockout duration based on security level ensures the protection of high-value accounts (such as system administrators and financial personnel), while avoiding excessive restrictions on ordinary employee accounts. Fourth, setting a 24-hour lockout upper limit avoids the service availability problems caused by indefinite lockout, achieving a balance between security and availability.

[0058] Based on the above algorithm, a hierarchical lock strategy engine is designed to configure differentiated lock strategies for users of different security levels. Specifically, the strategy engine maintains a lock strategy configuration table with the following fields: security_level, max_failures, time_window_minutes, base_lockout_duration, progressive_lockout, and notify_admin.

[0059] The strategy configuration for security level 1: max_failures = 10 times, time_window_minutes = 30 minutes, base_lockout_duration = 30 minutes, progressive_lockout = false (fixed duration), notify_admin = false. This strategy is suitable for ordinary employee accounts and has high fault tolerance, allowing users to attempt 10 times within 30 minutes and locking for 30 minutes after failure.

[0060] The strategy configuration for security level 2: max_failures = 8 times, time_window_minutes = 30 minutes, base_lockout_duration = 60 minutes, progressive_lockout = false, notify_admin = false. This strategy is suitable for project managers, team leaders and other middle-level employees, slightly tightening the failure number limit and lockout duration.

[0061] Security Level 3 policy configuration: max_failures=5, time_window_minutes=15, base_lockout_duration=120, progressive_lockout=true, notify_admin=false. This policy is suitable for department managers, senior engineers, and other key position employees. It allows only 5 failed attempts within 15 minutes, and uses a progressive algorithm to calculate the lockout duration after triggering the lock.

[0062] Security Level 4 policy configuration: max_failures=3, time_window_minutes=10, base_lockout_duration=240, progressive_lockout=true, notify_admin=true. This policy is suitable for system administrators, database administrators, and other privileged accounts. It allows only 3 failed attempts within 10 minutes, and notifies the security administrator immediately after triggering the lock.

[0063] Security Level 5 policy configuration: max_failures=2, time_window_minutes=5, base_lockout_duration=480, progressive_lockout=true, notify_admin=true. This policy is suitable for CEO, CFO, CISO, and other senior executive accounts, as well as super administrator accounts. It allows only 2 failed attempts within 5 minutes, and uses the most stringent lockout strategy.

[0064] Create a custom Keycloak Authenticator to handle login failure events. When the user submits the login form, the Authenticator first extracts the username and password fields from the form. Query the user object through the Keycloak API, and return a general error message "Username or password error" if the user does not exist (do not disclose whether the user exists to prevent username enumeration attacks). If the user exists, call the password verification method to check the password correctness. If the password is incorrect, trigger the failure handling process.

[0065] The failure handling flow first records the failed attempt, creates a FailureRecord object containing fields: userId, timestamp (current time), ipAddress, userAgent, failureReason (WRONG_PASSWORD). The failure record is stored to a failure record table (could be a database table or a user attribute in Keycloak).

[0066] Then it gets the user's security level attribute securityLevel, queries the lockout policy configuration table to get the corresponding policy object policy. According to policy.time_window_minutes, it determines the time window, queries the failure record table, and counts the number of failures failureCount of the user within the time window (current time minus time_window_minutes). Compare failureCount and policy.max_failures, if failureCount is less than max_failures, it means that the lock threshold has not been reached, return the login failure response, and include the remaining attempt number prompt information "Login failed, you have X attempts" in the response, where X = max_failures - failureCount.

[0067] If failureCount is greater than or equal to max_failures, trigger the account lockout operation. Query the user's historical lockout times in the past 24 hours, set as previousLockouts. Analyze the recent failure attempt records, extract the IP address list, count the number of different IPs, extract the timestamp list, calculate the time interval of adjacent attempts, and determine the attack pattern coefficient μ according to the distributed and high-frequency characteristics. Call the progressive lockout duration calculation algorithm, pass in parameters (from policy), N (previousLockouts + 1), L (securityLevel), μ, and calculate the lockout duration T.

[0068] Then, the adaptive unlocking in step S4 includes: Through a timing task, scan the locked accounts, when the system time exceeds the lockout duration expiration time, automatically execute the unlocking operation, restore the account state and clear the related failure records; Support administrators to manually unlock accounts through the management interface, when manually unlocking, record the administrator's identity and the unlocking reason, and update the audit log.

[0069] Meanwhile, the administrator can also manually unlock the account through the management console. The administrator logs in to the Keycloak management console, navigates to the Users menu, searches for and opens the user detail page of Zhao Liu. On the user detail page, the administrator sees that the user is currently in the disabled state (enabled = false), and sees the lock reason and the expected unlock time. The administrator clicks the "Unlock Account" button, and the system pops up a confirmation dialog box, asking the administrator to enter the unlock reason (such as "User identity has been confirmed"). After the administrator confirms, the system performs the same operation process as automatic unlocking, but records it as ADMIN_MANUAL_UNLOCK in the audit log, and records the administrator's username and unlock reason.

[0070] In step S5, in order to detect and prevent security threats such as session hijacking, account sharing in real time, the present scheme proposes a session anomaly scoring algorithm, which quantitatively evaluates the abnormality degree of the session by analyzing the multi-dimensional features such as the geographic location, device fingerprint, and behavior pattern of the session. The real-time detection of session anomaly specifically includes: Real-time monitoring of user sessions, collecting multi-dimensional features including login geographic location, device fingerprint information, user operation behavior characteristics, and login time sequence; Based on the multi-dimensional features, the geographic location abnormality degree, device abnormality degree, behavior abnormality degree, and speed abnormality degree are calculated respectively, and the weighted fusion of each abnormality degree is performed to obtain a comprehensive session anomaly score; According to different intervals of the session anomaly score, trigger corresponding processing strategies, including recording logs, sending security warnings to users and requiring secondary verification, or immediately terminating the session and notifying the administrator.

[0071] Among them, the calculation of the speed abnormality degree involves impossible travel detection: Obtain the geographic location and corresponding time interval of the user's previous and subsequent logins; Calculate the physical distance between the two points based on the geographic location, and calculate the shortest theoretical time required based on the preset travel speed; Compare the actual time interval with the theoretical time, if the actual time interval is less than the shortest theoretical time, it is determined that there is an impossible travel situation, and the speed abnormality degree is calculated accordingly.

[0072] Here, the session anomaly scoring formula is: wherein, represents the session anomaly score, with a value range of [0, 1], and the larger the value, the higher the abnormality degree, represents the geographic location abnormality degree, with a value range of [0, 1], represents the device abnormality degree, with a value range of [0, 1], represents the behavior abnormality degree, with a value range of [0, 1], represents the speed abnormality degree (impossible travel detection), with a value range of [0, 1], and are weight coefficients of the above four indexes respectively, satisfying In this embodiment, they are 0.3, 0.25, 0.2, and 0.25 respectively.

[0073] Specifically, the calculation formula of the geographical position abnormality degree G is: where distance is the geographical distance (kilometers) between the current session IP address and the user's historical frequently used IP address, threshold is the distance threshold (set to 500 kilometers), and k is the attenuation coefficient (set to 0.002). When the distance is 0, G = 0, and the farther the distance, the closer G is to 1; Based on the device fingerprint matching degree, the device fingerprint includes operating system, browser type and version, screen resolution, time zone, language, font list and other features. The similarity similarity (with a value range of [0, 1]) between the current device fingerprint and the user's historical device fingerprint library is calculated, that is, that is, the lower the similarity with the most similar historical device, the higher the abnormality degree.

[0074] Analyze the user's operation behavior mode, including the frequency of accessing the system, the operation time period, the operation time length, etc. Establish a user behavior baseline model, calculate the deviation deviation (standardized to [0, 1]) between the current session behavior and the baseline, that is,

[0075] If the user logs in from geographical position A and then logs in from a remote geographical position B in a short time, it is judged according to the physical law whether it is possible to achieve. The calculation formula is: where is the actual time interval (hours) between the two logins, is the shortest time required to travel from A to B at the speed of an airplane (800 kilometers / hour). If , it means that there is impossible travel, and V > 0.

[0076] The abnormality processing strategy is determined according to the score A: When A ≥ 0.8, it is determined as highly abnormal, the session is immediately terminated and the user and the administrator are notified; When 0.6 ≤ A < 0.8, it is determined as suspicious, the session is marked as suspicious state, a security warning is sent to the user, and secondary verification is required; When 0.4 ≤ A < 0.6, it is determined as mild abnormality, the log is recorded and continuous monitoring is carried out.​​​ When A < 0.4, it is determined to be normal.

[0077] The algorithm formula provides comprehensive anomaly detection capability through dimension feature fusion. Single dimension change may have a reasonable explanation (such as a user going on a business trip), but multi-dimensional simultaneous anomaly indicates a high probability of security threat. Secondly, account sharing and credential theft behaviors are effectively identified through impossible travel detection. Even if the attacker obtains the correct username and password, it is difficult to fake the user's geographic location transfer track. At the same time, the introduction of device fingerprints and behavior baselines enables the system to learn the unique usage patterns of each user, enabling personalized anomaly detection and reducing false positive rates. In addition, the hierarchical processing strategy balances security and user experience. Mild anomalies are only logged without disturbing the user, moderate anomalies require additional verification, and high-level anomalies are immediately blocked, avoiding the "one-size-fits-all" simple processing method. Actual deployment data shows that the algorithm successfully detects and prevents 95% of session hijacking attacks with a false positive rate of less than 2%.

[0078] In addition, the point logout global invalidation described in step S5 is implemented in the following way: Configure a back-channel logout address for each integrated client system in the identity management server; When the user initiates a logout request in any system, the identity management server destroys the central session and sends a logout notification to the back-channel logout address of all client systems where the user has logged in; After receiving the logout notification, each client system verifies the message validity and then destroys its local session.

[0079] Specifically, the "one-point logout, global invalidation" mechanism is implemented to ensure that all related system sessions are invalidated simultaneously after the user logs out of any system. The Back-Channel Logout back-channel logout function is configured in Keycloak, which is a server-to-server communication mechanism. Keycloak actively notifies all logged-in client applications when the user logs out.

[0080] Configure a Back-Channel Logout URL for each integrated business system. For example, in the configuration of the OA system, set the Admin URL, which is a special endpoint provided by the OA system to receive logout notifications from Keycloak. In the client configuration of Keycloak, enable the Back-Channel Logout Session Required option, indicating that the session ID information is included in the logout notification. Enable the Back-Channel Logout Revoke Offline Tokens option to ensure that offline tokens (used for the "remember me" function) are also revoked.

[0081] The business system implements a Back-Channel Logout endpoint that receives a POST request sent by Keycloak with a JWT-formatted logout_token in the request body. The Logout Token contains standard JWT fields: iss issuer (URL of Keycloak), aud audience (client ID), iat issued-at time, exp expiration time, and special fields sid session ID, events event type.

[0082] Upon receiving the logout request, the backend service of the OA system first verifies the signature of the JWT to ensure that the request indeed comes from a trusted Keycloak server. After verification, the sid session ID field is extracted from the JWT. In the session management module of the OA system, the local session that matches the Keycloak session ID is found. After finding, the local session is immediately terminated, and the session data is cleared, so that the user corresponding to the session cannot continue to access the OA system. Log the session ID, termination time, and termination reason (BACK_CHANNEL_LOGOUT). Return an HTTP 200 status code to Keycloak, indicating that the logout request has been successfully processed.

[0083] When the user clicks the logout button in any integrated system (such as CRM), the logout processing logic of the CRM system first clears the local session, and then redirects the user to the logout endpoint of Keycloak with the parameter redirect_uri specifying the jump address after logout. After receiving the logout request, Keycloak destroys the server-side SSO session, and then iterates through all client applications (OA, CRM, email system, etc.) that the user has logged into in the current session, and sends a Back-Channel Logout request to the Admin URL of each client application. After receiving the request, all client applications terminate their respective local sessions. After completion, Keycloak redirects the user to the address specified by redirect_uri, which is usually the homepage or login page of the enterprise portal.

[0084] In addition, a unified session management interface is provided for administrators, which: obtains and displays a list of all active sessions by calling the management interface, and the list information includes user identification, client network address, session duration, associated client system, and session state; provides filtering and searching functions by user identification, client system, or session state, and supports automatic periodic refreshing of list data; A session context viewing function is provided for displaying detailed information of users, detailed device fingerprint information and parsed geo-location information of sessions, detailed results of anomaly detection of sessions, and authentication event timelines associated with sessions; Support for administrators to manually select one or more sessions and force termination, which triggers the identity management server to send logout notifications to the relevant client systems.

[0085] Specifically, a session management console is provided for administrators to view and manage all user sessions in real time. The GET / admin / sessions management API interface is developed, which supports query parameters username for filtering by username, clientId for filtering by client ID, and status for filtering by session state (active / suspicious). The API implementation logic is to connect to the Keycloak database or through the Keycloak Admin REST API to query the UserSession table. If the username parameter is specified, first find the user ID according to the username, then query all sessions of the user. If the clientId is specified, filter out the UserSession containing the client session.

[0086] For each UserSession object, extract key information to construct a SessionInfo response object: sessionId unique session identifier, username username, userId user ID, ipAddress client IP address (read from session Notes), startTime session start timestamp, lastAccessTime last access timestamp, clientSessions list of associated client sessions (containing client ID and client name), suspicious flag indicating if marked as suspicious (read from session Notes), suspiciousReason reason for being suspicious if any, anomalyScore anomaly score if any. Serialize the list of SessionInfo objects into JSON format and return to the frontend. The frontend uses a framework like React or Vue to build the management interface, which contains a table displaying the list of sessions with columns: username, IP address, start time, last activity, duration, associated systems, status, actions. The duration column is calculated in real-time by subtracting startTime from the current time and formatted to display (e.g., "2 hours 15 minutes"). The status column displays badges based on the suspicious flag: orange "Suspicious" badge for suspicious sessions, green "Normal" badge for normal sessions. The actions column contains a "Terminate session" button. Above the table, there are filtering and searching functionalities. The search box supports entering a username to quickly find a session. The dropdown menu supports filtering by status (All / Normal / Suspicious). The dropdown menu supports filtering by client (All / OA / CRM / Email / ...). Set up automatic refreshing every 30 seconds to call the API and update the session list, ensuring that the administrator sees real-time data.

[0087] When the administrator clicks the "Terminate session" button for a certain session, the frontend pops up a confirmation dialog: "Are you sure you want to terminate the session of user XXX? This operation will immediately log out the user from all systems." After the administrator confirms, the frontend sends a DELETE / admin / sessions / {sessionId} request to the API. The backend receives the request and verifies the administrator's permissions (checks the administrator token in the request header). It deletes the specified UserSession object through the Keycloak Admin API, and Keycloak performs the session termination operation, sending a Back-Channel Logout notification to all associated clients. Record an audit log: administrator username, operation type SESSION_TERMINATED_BY_ADMIN, target user, session ID, termination time, termination reason. Return a success response to the frontend. The frontend displays a successful operation prompt and refreshes the session list.

[0088] The management interface also provides session details viewing function, click on a session row to expand the details panel to display more information: the user's complete information (department, security level, mailbox, etc.), detailed timeline of the session (creation time, each access time, accessed pages), device fingerprint information (operating system, browser, screen resolution), geographic location information (country, city, latitude and longitude according to IP address resolution, marked on the map), abnormal detection results (if it is a suspicious session, display the scores and reasons of each sub-item score of the abnormal score), associated authentication events (login time, login method, whether to use two-factor authentication).

[0089] Administrators can also perform batch operations, check multiple sessions and click the "Batch Terminate" button to terminate multiple sessions simultaneously. After the system confirms, it traverses the selected session ID list and calls the delete API one by one. This is very useful when dealing with large-scale security incidents, for example, when abnormal activity is found in a certain IP address segment, the administrator can quickly terminate all sessions from that IP segment.

[0090] Through the application of the above methods, a complete multi-system single sign-on security management method based on LDAP and Keycloak is constructed, which realizes centralized management of user identity, intelligent active management of password life cycle, adaptive protection of account security, and unified cooperative control of cross-system sessions, significantly improving the security, availability and manageability of enterprise information systems, and providing a solid identity and access management infrastructure for enterprise digital transformation.

[0091] On the other hand, the present application also provides a multi-system single sign-on security management system, as shown in Figure 2 The system comprises: a deep integration and bidirectional synchronization module 10 for establishing a deep integration architecture between the directory service and the identity management server, realizing bidirectional synchronization of user attributes and security policies by configuring user federation and attribute mapping relationship; a unified authentication and security defense module 20 for configuring a unified multi-factor authentication process and security defense strategy in the identity management server; an intelligent password life cycle management module 30 for implementing risk score-based password expiration evaluation and multi-channel reminders, as well as password self-service modification services, to realize intelligent password life cycle active management; an intelligent account locking and unlocking module 40 for implementing multi-factor-based intelligent account locking and adaptive unlocking, dynamically calculating and executing differentiated lock duration through a progressive locking algorithm; a unified session management and cooperative control module 50 for establishing a unified session management and cooperative control mechanism across systems, performing real-time session anomaly detection and scoring through multi-dimensional feature fusion, and realizing one-point logout global invalidation based on the post-channel logout mechanism.

[0092] It should be noted that the steps of the multi-system single sign-on security management method provided in the embodiments can be implemented based on corresponding modules in the multi-system single sign-on security management system, and those skilled in the art can refer to the technical solutions of the system to implement the step flow of the method, that is, the embodiments in the system can be understood as preferred examples of implementing the method, and details are not described herein.

[0093] In the embodiments, an electronic device is also provided, as shown in the figure, which includes a processor 14 and a memory 13, the memory 13 stores machine executable instructions capable of being executed by the processor 14, and the processor 14 executes the machine executable instructions to implement the above-mentioned audio control method. Figure 3

[0094] Further, Figure 3 As shown in the figure, the electronic device also includes a bus 12 and a communication interface 11, and the processor 14, the communication interface 11 and the memory 13 are connected through the bus 12.

[0095] The memory 13 can include a high-speed random access memory (RAM), and can also include a non-volatile memory, such as at least one disk memory. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 11 (which can be wired or wireless), and the Internet, a wide area network, a local area network, a metropolitan area network, etc. can be used. The bus 12 can be an ISA bus, a PCI bus, an EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 In the figure, only one bidirectional arrow is used to represent the bus, but it does not mean that there is only one bus or only one type of bus.

[0096] ​The processor 14 can be an integrated circuit chip with processing capability. In implementation process, each step of the above method can be completed by integrated logic circuit of hardware in the processor 14 or by instructions in the form of software. The processor 14 described above can be a general processor, including a central processing unit (CPU), a network processor (NP), etc.; can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component. Each method, step and logic block diagram disclosed in the embodiment can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in combination with the embodiment can be directly embodied as a hardware code processor for execution, or a combination of hardware and software modules in the code processor for execution. The software module can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium in the art. The storage medium is located in the memory 13, and the processor 14 reads the information in the memory 13, and combines the hardware to complete the steps of the audio control method.

[0097] The present disclosure also provides a computer readable storage medium, which can be a non-volatile computer readable storage medium, and can also be a volatile computer readable storage medium, and the computer readable storage medium stores a computer program, which makes the computer execute the steps of the audio control method when the computer program runs on the computer.

[0098] Finally, it should be noted that: the above only describes the preferred embodiments of the present application, the protection scope of the present application is not limited to the above-mentioned embodiments, any technical solution belonging to the idea of the present application is also within the protection scope of the present application. It should be pointed out that for ordinary skilled in the art, without departing from the principle of the present application, some improvements and decorations, these improvements and decorations should also be considered as the protection scope of the present application.

[0099] The technical features of the above-described embodiments can be combined arbitrarily, and in order to make the description simple, all possible combinations of the technical features in the above-described embodiments are not described, however, as long as the combination of the technical features does not exist contradictory, it should be considered that it is within the scope of the present disclosure.

Claims

1. A multi-system single sign-on security management method, characterized by, Comprise the following steps: S1: Establish a deep integration architecture between the directory service and the identity management server, realize the bidirectional synchronization of user attributes and security policy by configuring user federation and attribute mapping relationship; S2: Configure unified multi-factor authentication process and security defense strategy in the identity management server; S3: Through the implementation of password expiration assessment based on risk score and multi-channel reminder, and password self-service modification service, realize the intelligent password life cycle active management; S4: Implement intelligent account locking and adaptive unlocking based on multi-factor, dynamically calculate and execute differentiated locking time through progressive locking algorithm; S5: Establish a unified session management and collaborative control mechanism across systems, detect and score session anomalies in real time through multi-dimensional feature fusion, and realize one-point logout global invalidation based on the post-channel logout mechanism.

2. The multi-system single sign-on security management method of claim 1, wherein, In step S1, the deep integration architecture between the directory service and the identity management server specifically comprises: Design a standardized user entry structure in the directory service, which includes basic attributes, authentication attributes, security attributes and extended attributes; Configure user federation in the identity management server, set connection parameters, user search reference location and user identifier mapping rules with the directory service; Establish a bidirectional mapping relationship between the directory service attributes and the identity management server user attributes; Enable periodic full synchronization and periodic incremental synchronization mode to realize bidirectional synchronization and change write-back of user data.

3. The multi-system single sign-on security management method of claim 1, wherein, In step S2, configuring a unified multi-factor authentication process and security defense strategy specifically includes: Customize the authentication process, add multiple authentication execution steps in sequence, including session existence check, user account state pre-check, username and password form authentication, password expiration check and conditional two-factor authentication; Configure brute force cracking protection strategy, set maximum login failure times, failure attempt time window, failure waiting time and failure counter reset time; Configure token strategy, set access token life cycle, client login timeout time and overall login process timeout time; Configure global password policy, set password complexity requirements, including minimum length, character type combination, historical password repetition limit and weak password pattern detection rules based on regular expressions.

4. The multi-system single sign-on security management method of claim 1, wherein, In step S3, the password expiration assessment based on risk score includes: Through the monitoring mechanism, scan the active users in the directory service at regular intervals, get the password last modification time and user security level of each user; Based on the remaining valid days of the password, the user security level, the user historical password modification compliance rate and the recent login failure times, the password expiration risk score is calculated by weighting; According to the risk score, dynamically determine the reminding strategy of different urgency levels, the reminding strategy is the combination of reminding frequency and reminding channel, and the reminding channel includes one or more of email, SMS and system message.

5. The multi-system single sign-on security management method of claim 4, wherein, In step S3, the password self-service modification service: Provide a password modification interface, which integrates real-time password strength detection function, dynamically assesses whether the password meets the preset complexity requirements; Verifying the correctness of the current password, whether the new password meets the policy requirements, and whether the new password is repeated with the historical password in the background; After verification, synchronously update the user password credentials in the identity management server and directory service, and invalidate all existing sessions of the user.

6. The multi-system single sign-on security management method of claim 1, wherein, In step S4, the multi-factor based intelligent account locking specifically includes: Configuring differentiated account locking policies for users of different security levels, including the maximum number of allowed failures, the time window for counting the number of failures, the basic locking duration, and whether to enable progressive locking; When the number of user login failures reaches the set threshold, dynamically calculating the actual locking duration based on the user's security level, the number of historical lockings within a certain time window, and the attack pattern characteristics presented by the current failure attempt; The locking duration is increased exponentially based on the number of historical lockings, and is adjusted according to the attack pattern characteristics and the security level, while setting an upper limit for the locking duration.

7. The multi-system single sign-on security management method of claim 6, wherein, The determination of the attack pattern characteristics includes: Analyzing whether the failure attempts come from multiple different network addresses, and if so, determining that there is a distributed attack characteristic; Analyzing whether the time interval between failure attempts is less than a certain threshold, and if so, determining that there is an automated attack characteristic; Based on the determination results of the distributed attack and automation characteristics, the attack pattern coefficient is determined comprehensively to adjust the locking duration.

8. The multi-system single sign-on security management method of claim 6, wherein, The adaptive unlocking includes: Through a timing task, the locked account is scanned, and when the system time exceeds the expiration time of the locking duration, the unlocking operation is automatically performed to restore the account state and clear the related failure records; Supporting administrators to manually unlock accounts through a management interface, and recording the administrator identity and unlocking reason when manually unlocking, and updating the audit log.

9. The multi-system single sign-on security management method of claim 1, wherein, In step S5, the real-time session anomaly detection specifically includes: Real-time monitoring of user sessions, collecting multi-dimensional features including login geographic location, device fingerprint information, user operation behavior characteristics, and login time sequence; Based on the multi-dimensional features, the geographic location anomaly degree, the device anomaly degree, the behavior anomaly degree, and the speed anomaly degree are calculated respectively, and the weighted fusion of each anomaly degree is performed to obtain a comprehensive session anomaly score; According to different intervals of the session anomaly score, trigger corresponding processing strategies, including recording logs, sending security warnings to users and requiring secondary verification, or immediately terminating the session and notifying the administrator.

10. The multi-system single sign-on security management method of claim 9, wherein, The calculation of the speed anomaly degree involves impossible travel detection: Obtain the geographic location and corresponding time interval of the user's previous two logins; Based on the geographic location, calculate the physical distance between the two points, and based on the preset travel speed, calculate the shortest theoretical time required; Compare the actual time interval with the theoretical time, if the actual time interval is less than the shortest theoretical time, it is determined that there is an impossible travel situation, and the speed anomaly degree is calculated accordingly.

11. The multi-system single sign-on security management method of claim 1, wherein, In step S5, the one-point logout global invalidation is achieved by the following methods: Configuring a back channel logout address for each integrated client system in the identity management server; When the user initiates a logout request in any system, the identity management server destroys the central session and sends a logout notification to the back channel logout address of all client systems where the user has logged in; Upon receiving the logout notification, each client system verifies the message validity and then destroys its local session.

12. The multi-system single sign-on security management method of claim 1, wherein, Further comprising providing an administrator with a unified session management interface, which: Obtains and displays a list of all active sessions by calling the management interface, and the list information includes user identification, client network address, session duration, associated client system, and session state; Provides filtering and searching functions by user identification, client system, or session state, and supports automatic periodic refreshing of list data; Provides session profile viewing functions for displaying detailed user information, session detailed device fingerprint information and parsed geographic location information, session abnormality detection detailed results, and session associated authentication event timeline; Supports manual selection of one or more sessions by the administrator and forced termination, which triggers the identity management server to send logout notifications to the relevant client systems.

13. A multi-system single sign-on security management system, characterized by comprising: Comprise: A deep integration and bidirectional synchronization module for establishing a deep integration architecture between the directory service and the identity management server, implementing bidirectional synchronization of user attributes and security policies by configuring user federation and attribute mapping relationships; A unified authentication and security defense module for configuring a unified multi-factor authentication process and security defense policy in the identity management server; An intelligent password lifecycle management module for implementing risk score-based password expiration evaluation and multi-channel reminders, as well as password self-service modification services, to achieve intelligent password lifecycle proactive management; An intelligent account locking and unlocking module for implementing multi-factor-based intelligent account locking and adaptive unlocking, and dynamically calculating and executing differentiated lock durations through a progressive locking algorithm; A unified session management and collaborative control module for establishing a unified session management and collaborative control mechanism across systems, performing real-time session anomaly detection and scoring through multi-dimensional feature fusion, and implementing one-point logout global invalidation based on a post-channel logout mechanism.

14. A computer-readable storage medium having stored thereon a computer program, characterized in that, The program, when executed by a processor, implements the multi-system single sign-on security management method of any one of claims 1-12.

15. An electronic device, comprising: Comprise: One or more processors; Storage devices for storing one or more programs, which, when executed by the one or more processors, cause the one or more processors to implement the multi-system single sign-on security management method of any one of claims 1-12.

Images